Microsoft patched a high-severity vulnerability (CVE-2026-80097) in Authenticator for Android, allowing malicious apps to steal work account tokens without permissions. Enclave researchers discovered the flaw, which was patched in July 2026 and assigned a CVSS 8.6 rating.
A critical security flaw in Microsoft Authenticator for Android, tracked as CVE-2026-80097, has been resolved after researchers revealed how malicious apps could steal work account tokens without requiring user permission or additional Android privileges. The vulnerability, which received a CVSS score of 8.6, was addressed in Microsoft Authenticator version 6.2606.4246, released in July 2026 (Phoneworld).
How the Vulnerability Worked
The flaw exploited an exported Android activity named com.microsoft.identity.client. AccountChooserActivity, which allowed any app on a device to impersonate a trusted Microsoft application like Teams. By supplying forged identity details—such as a claimed package name and redirect URI—malicious apps could trick Authenticator into issuing delegated tokens without verifying the true caller (CyberSecurityNews).
Researchers at Enclave demonstrated that an attacker could gain access to Microsoft Graph resources, including email, calendars, and OneDrive files, by impersonating applications like Teams. The flaw relied on Authenticator validating the redirect URI against the claimed app’s signature, which could be faked using publicly available details from legitimate Microsoft apps (Helpnetsecurity).
Enclave researcher Ofek Levin, part of the firm’s fellowship program, detailed the technique in a report titled AuthMask, published October 23, 2026. The vulnerability allowed an untrusted app to pose as a Microsoft application, such as Teams, and request authentication tokens without user interaction. Authenticator checked whether the claimed app’s redirect URI matched a legitimate installed application, but attackers could bypass this check by leveraging the public package signature of the real app (Androidpure).
The flaw sat in an account-selection activity within Authenticator that any app on the device could launch. Authenticator validated the redirect URI against the signature of the app the caller claimed to be, but it did not verify the actual calling app. This allowed malicious apps to impersonate trusted Microsoft applications, such as Teams, and obtain delegated tokens for Microsoft Graph, including access to email, files, calendars, and SharePoint sites (Cyberpress).
🚨 CRITICAL ANDROID SECURITY FLAW: A MALICIOUS APP COULD STEAL YOUR MICROSOFT WORK ACCOUNT TOKENS Due to a flaw in Microsoft Authenticator.CVE-2026-80097 exposes a dangerous vulnerability in Microsoft Authenticator that could let a rogue Android app hijack authentication token…
In a proof of concept, researchers impersonated Microsoft Teams and requested Microsoft Graph permissions, which returned access and refresh tokens with delegated access. These tokens enabled the malicious app to read and send email, access files, and modify calendars. The attack required a malicious app already installed on the device, but no further user interaction was needed beyond having a work account signed into Authenticator (Expertinsights).
Microsoft’s Response
Microsoft classified the vulnerability as an elevation of privilege issue caused by improper authentication in the app’s broker component. The company confirmed the flaw was not exploited in the wild and released the fix through Google Play. Users were advised to update to version 6.2606.4246 or later (Cyberpress).
Microsoft Authenticator for Android had a flaw that let apps with zero permissions steal work tokens. Here's what you need to know.Microsoft patched a high-severity bug, CVE-2026-80097, in Authenticator for Android. The CVE record, dated Sep 8, describes it as improper… https://t.co/eUcbKbR7yl pic.twitter.com/rZEAvmemAr
The vulnerability was reported to the Microsoft Security Response Center and patched on September 8, 2026, as part of a broader security update. Microsoft assigned CVE-2026-80097 a CVSS 3.1 base score of 8.6 and a temporal score of 7.5, rating it as Important. It was classified under CWE-287, Improper Authentication, and affected Authenticator for Android versions from 6.0.0 up to, but not including, 6.2606.4246 (Expertinsights).
While Microsoft’s advisory noted user interaction as a requirement for exploitation, Enclave researchers argued that no user action was needed beyond having a work account signed into Authenticator.
What Users Should Do
Users of Microsoft Authenticator on Android are urged to update the app immediately through the Google Play Store. Organizations should ensure company-managed devices receive the update via mobile device management (MDM) systems. Security teams are also advised to monitor for unusual Microsoft Graph activity and revoke suspicious tokens (Expertinsights).
Enclave’s research, published under the AuthMask project, underscores the importance of validating the true caller in authentication flows. The incident also prompted Microsoft to reinforce protections for work accounts on Android devices.
The apps that are supposed to protect you are the best attack vectors. We pointed our agents at Microsoft Authenticator:We discovered any Android app with zero permissions could say “I’m Teams” and capture your tokens. Mail, files, calendar.Huge find by @ofekdavidlevin https://t.co/igkQhlUu4T
Organizations should assess mobile application controls, ensure timely app updates through MDM or EMM platforms, and limit sideloaded applications where feasible. Security teams should also track unusual Microsoft Graph activity, unexpected consent behavior, and token activity from unknown Android devices. Microsoft’s official CVE-2026-80097 advisory should be used for ongoing remediation guidance (Expertinsights).
Broader Implications
The flaw highlights ongoing challenges in securing mobile authentication systems, where apps must balance convenience with strong verification. As Android prepares to restrict app access to contacts in 2027, the incident highlights the importance of security measures.
Enclave’s report found no evidence of exploitation in the wild, but the vulnerability required a malicious app already installed on a device with Authenticator and a signed-in work account. Users are advised to avoid sideloading apps from unknown sources and to remove any unrecognized applications (Expertinsights).
Microsoft’s advisory stresses the importance of keeping authentication apps current to protect work accounts and prevent unauthorized access to sensitive information. The company also noted that the vulnerability was resolved through responsible disclosure, with Enclave reporting the flaw to the Microsoft Security Response Center (Expertinsights).
We got Microsoft Authenticator to hand over account tokens to a fake Teams app.The app needed zero Android permissions. It just claimed to be Teams, and Authenticator never checked who was actually asking. The result: full delegated access to mailbox, files, and calendar…